I am using using NIS v. 20.4.0.40 (NIS 2013) with Vista 32-bit Home Premium. After each idletime QuickScan, my CPU continues to run at approx. 20% and I can see my hard drive continuously thrashing until I take my system out of idle. When I click inside the NIS Performance Graph the pop-up simply says "No Activity".
Sysinternal's Process Explorer shows that the process SYSTEM (PID 4) and specifically Symantec's SRTSP.SYS (i.e., Symantec Real-time AutoProtect - TID 3624) is responsible for this high CPU activity during post-QuickScan idles. The thrashing of my hard drive corresponds to a rapid increase in disk I/O reads by ccSvcHst.exe (PID 320), and depending on the amount of time my system remains in idle, these I/O reads by ccSvcHst.exe can exceed more than 20 million reads within a matter of hours after boot-up.
I performed a clean re-install of NIS v. 20.4.0.40 but this high activity by SRTSP.SYS during idles persists. A search of the forum led me to a post here by elsewhere and shows that this issue with NIS 20.x also occurs with Win 7, etc.
Does anyone know if Symantec is planning to fix this issue in NIS 20.x, or if the same problem has been reported in NIS 21.x? ------------ MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40 HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
I am using using NIS v. 20.4.0.40 (NIS 2013) with Vista 32-bit Home Premium. After each idletime QuickScan, my CPU continues to run at approx. 20% and I can see my hard drive continuously thrashing until I take my system out of idle. When I click inside the NIS Performance Graph the pop-up simply says "No Activity".
Sysinternal's Process Explorer shows that the process SYSTEM (PID 4) and specifically Symantec's SRTSP.SYS (i.e., Symantec Real-time AutoProtect - TID 3624) is responsible for this high CPU activity during post-QuickScan idles. The thrashing of my hard drive corresponds to a rapid increase in disk I/O reads by ccSvcHst.exe (PID 320), and depending on the amount of time my system remains in idle, these I/O reads by ccSvcHst.exe can exceed more than 20 million reads within a matter of hours after boot-up.
I performed a clean re-install of NIS v. 20.4.0.40 but this high activity by SRTSP.SYS during idles persists. A search of the forum led me to a post here by elsewhere and shows that this issue with NIS 20.x also occurs with Win 7, etc.
Does anyone know if Symantec is planning to fix this issue in NIS 20.x, or if the same problem has been reported in NIS 21.x? ------------ MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40 HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
Hi Imacri, I know you must have a very good reason for staying with v 20, but I downloaded v 21 on the day of release, and it's working fine on my machines. One laptop and one desktop, both on v 21. No thrashing, here !..... You can always revert, if you aren't happy with v 21.
After an Idle Quick Scan, a Norton 'SRTSP.SYS' thread will continue running under the 'System' process, as shown by the blue-coloured, 'No Activity' selection highlighted during an Idle Time period on the graph below. Please note the 22.73 percent CPU usage by this thread in the Process Explorer window below. Full details regarding the issue can be found in my previous post here:
Thank you for letting me know that the high CPU usage by SRTSP.SYS after QuickScans also occurs in NIS 21.x. - at least for those of us who reported this issue with NIS 20.x. Have you tried upgrading to NIS v. 21.1.0.18 to see if this problem persists in the latest version?
I posted about this problem here back in Dec 2012 but that thread degenerated so badly that the forum administrator had to lock the thread to prevent further discussion. I noticed that the link you provided to another thread on the same topic here suffered a similar fate before anyone from Symantec could provide input.
I'd be happy to run further diagnotics or provide memory dumps if anyone from Symantec is interested in pursuing this. ------------ MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40 HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
Thank you for letting me know that the high CPU usage by SRTSP.SYS after QuickScans also occurs in NIS 21.x. - at least for those of us who reported this issue with NIS 20.x. Have you tried upgrading to NIS v. 21.1.0.18 to see if this problem persists in the latest version?
[...]
Hi lmacri
Sorry for the delay; the issue is still present in NIS v. 21.1.0.18 under Windows 7:
The important point to note here is that the 'No Activity' SRTSP.SYS CPU usage, after an Idle Quick Scan, actually ends under Windows 7, as shown by the blue inverted triangle above.
Under Vista 32-bit Home Premium however, I'm actually seeing worse results than the ones you described here:
For me, the 'No Activity' process locks around 50 percent of the CPU (1 of 2 cores). After an Idle Quick Scan, the only way for me to stop Norton's idle 'No Activity' CPU usage is to reboot the PC.
Does Norton's idle 'No Activity' CPU usage actually end for you on your PC if you let it continue unabated?
For me, the 'No Activity' process locks around 50 percent of the CPU (1 of 2 cores). After an Idle Quick Scan, the only way for me to stop Norton's idle 'No Activity' CPU usage is to reboot the PC.
Hi elsewhere:
I haven't monitored this idletime activity by SRTSP.SYS closely enough on my 32-bit Vista machine to make a definitive statement, but the behaviour depends largely on how long my idletime lasts. If I change my power settings to prevent my system from going into sleep mode and force a prolonged idle, this period of "No Activity" continues as long as my system remains in idle - see my screenshot in message # 1. The activity stops when I take my system out of idle and typically does not start again at the next idle.
If I use my default power setting so that my system normally goes into sleep mode after 25 min of inactivity, idletime activity by SRTSP.SYS runs every time my system goes into idle, stopping when I take my system out of idle, and starting again at each subsequent idle. I think sleep mode is enough to halt this continuous cycling of activity by SRTSP.SYS during idles, but I'm not sure about that and it's possible that a boot-up is necessary to stop the cycling.
I've only noticed one occassion where this idletime activity by SRTSP.SYS appeared to stop of it's own accord on my 32-bit Vista system. I ran a manual full system scan on 31-Oct-2013 and the SRTSP.SYS activity terminated by itself. I seem to recall checking my Norton tasks and confirmed that an automatic QuickScan ran just as the full system scan was completing. Sorry, my screenshot below from 31-Oct-2013 didn't capture the graph's pop-up but I did confirm that this was another period of high CPU usage labelled as "No Activity" and not due to some other non-Norton process like the Windows File Indexing or Windows Disk Defragmenter.
------------ MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40 HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
Any chance this is disk optimization occurring? It may not show up as a Norton task as it uses the Windows defrag routine.
Hi peterweb:
Norton's Idle Time Optimizer is disabled in my settings and my Norton Tasks window confirms that the Insight Optimizer task has never run on my machine.
If a Windows process like Windows Disk Defragmenter (dfrgntfs.exe for 32-bit Vista) runs during idle the process will be correctly identified in the activity graph pop-up. The pop-up for a QuickScan or Full System Scan will correctly identify the process as ccSvcHst.exe (not NIS.exe, since I use NIS v. 20.4.0.40) and CPU activity by ccSvcHst.exe will correctly display as yellow, (not blue) peaks in the graph.
Since these periods of "No Activity" consistently occur after idletime QuickScans, all I have to do is start real-time monitoring in Process Explorer, adjust my power settings to delay sleep mode, open the Norton Performance window and wait for a QuickScan to run during idle. The 20-25% CPU usage (and high I/O disk reads) by "No Activity" (or to be precise, 1% by Process Explorer, 19-25% unaccounted for by "No Activity") in the Norton Performance graph following the QuickScan always corresponds to 20-25% CPU usage by SRTSP.SYS in Process Explorer as shown in message # 1.
------------ MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40 HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
I'm still curious if Symantec has any explanation as to why some NIS 20.x (2013) and NIS 21.x (2014) users are seeing this high CPU and disk I/O activity by SRTSP.SYS (Symantec Real-time AutoProtect) during system idles that is labeled as "No Activity" in the Performance graph.
Since this high activity always seems to follow a Quick Scan, is this a case of a NIS scan not terminating correctly? Could I have some third-party software running in the background (e.g., a network monitoring program) that "wakes up" NIS real-time protection after a Quick Scan? Just FYI, NIS is the only AV software running in real-time protection mode on this computer.
Here's another screenshot from yesterday showing how these disk read/writes labeled as "No Activity" temporarily pause when I take my system out of idle.
------------ MS Windows Vista Home Premium 32-bit SP2 * Firefox 26.0 * IE 9.0 * NIS 2013 v. 20.4.0.40 HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
I wondered the same thing - however, if the Performance window were left open the Norton activity would be shown as yellow, so I think this issue is probably something different.
I wonder if that's what's causing the spikes in YOUR cases ? As mentioned, the actual monitoring seems to cause spikes ?
Hi F4E:
I re-labeled the screenshot I first posted in message # 12 to show that this constant disk thrashing by SRTSP.SYS during idles is esssential the same regardless of whether the NIS GUI is open or closed.
In the idle period labeled "A" when the GUI was open and I was monitoring the Performance graph in real-time, the pop-up in that part of the graph showed that ccSvcHst.exe was responsible for 1% of the total CPU (in yellow along the baseline), but the remaining ~ 15% of the total CPU (in blue) was this "hidden" activity by SRTSP.SYS.
In the idle period labeled "B" when the GUI was closed all ~ 15% of the total CPU was this blue "No Activity" by SRTSP.SYS.
The constant disk read/writes during idles by this "hidden" SRTSP.SYS activity that elsewhere and I are describing in this thread looks similar to what Cooloutac reported here but quite different from the yellow spikes of NIS.exe activity described by Steve_C here
------------ MS Windows Vista Home Premium 32-bit SP2 * Firefox 26.0 * IE 9.0 * NIS 2013 v. 20.4.0.40 HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
Could it have anything to do with system differences ? Vista 32 bit, or Windows 7 64 bit.
The problem doesn't appear to be related to the bit architecture of the OS. I use 32-bit Vista while Cooloutac and elsewhere use 64-bit Win7. All three of us noticed the problem after we upgraded to NIS 20.x (2013) and elsewhere reported that the problem persists in NIS 21.x (2014). elsewhere and I used Sysinternal's Process Explorer and independently came to the same conclusion that this post-Quick Scan idletime disk thrashing displayed as "No Activity" in the NIS Performance graph is caused by SRTSP.SYS (Symantec Real-time AutoProtect).
I have wiped and re-installed NIS v. 20.4.0.40 twice, essentially following the steps posted here by Phil_D (i.e., selecting "Please remove all user data" during the Control Panel uninstall followed by multiple re-boots and wipes with the Norton Removal Tool) and the idletime disk thrashing persists.
------------ MS Windows Vista Home Premium 32-bit SP2 * Firefox 26.0 * IE 9.0 * NIS 2013 v. 20.4.0.40 HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
I had the same issue with both my W7 x64 machines but after an idle quick scan which I know from experience that it takes about 3-5 mins I used to suspend the prolonged SRTSP activity by using my keyboard.
However, I made the huge mistake to let it finished itself the past 3-4 weeks and at one moment during a shutdown I had for the first time the dimmed screen message from W7 "NIS.exe, the referenced instruction at 0xxxxxxxxx could not be read by memory etc. Click OK to terminate the program" which is basically a warning that NIS 21 died and an uninstall process with NRT is more or less required.
This is the main reason why I stated in a previous message that it is essential that you have a complete System image backup before any trouble arises.
Once again, if Symantec is too busy to look at this and resolve, it would be great news if in the upcoming version update, the ability to manually disable the idle Quick Scans is offered, because the problem starts after an idle quick Scan finishes. (Not immediately after product installation, but after an estimated period of 2-3 weeks, at least for my machines).